BTCPay Server Wallets Drained and Mercado Bitcoin Loses $40 Million, Both Hit Days After Binance

Binance was not the only casualty this week. While the world's largest exchange absorbed the fallout from its record $6.3 billion theft, two very different corners of the Bitcoin and crypto world got hit in the same stretch of days: the open-source payment tool BTCPay Server, and Mercado Bitcoin, Brazil's largest crypto exchange.

A SELF-HOSTED BITCOIN TOOL GETS SWEPT

BTCPay Server is free, open-source software that lets merchants accept Bitcoin payments directly into wallets they control, without a payment company sitting in the middle. On November 1, the project told every operator to shut their servers down after receiving reports that hot wallets were being emptied by unauthorized attackers.

By the next day, BTCPay's team had narrowed the attack to installations running version 2.4.1, released July 23, 2026, or older. Attackers obtained administrator-level access through a method the project has not yet explained, and blockchain data firm Bitquery estimates that roughly $1.63 million in bitcoin and litecoin left merchant wallets across 682 sweeps, with most of the value moving in a single eight-hour window on November 1. Founder Nicolas Dorier said servers running the current 2.4.7 release, shipped October 29 with fixes for 85 security findings including one critical flaw, have no credible reports of drains. It is the second theft tied to pre-2.4.2 installations in three months; the first, in August, exploited a separate flaw to steal Lightning Network credentials.

Because BTCPay is self-hosted, the project has no master switch to shut down a merchant's server remotely, and it cannot promise reimbursement. Each operator who skipped an update absorbed the loss alone.

BRAZIL'S BIGGEST EXCHANGE LOSES OVER $40 MILLION OVERNIGHT

Mercado Bitcoin, which handles more than half of Brazil's retail crypto activity, suspended deposits and withdrawals on November 2 after wallets tied to the exchange were drained across at least ten blockchains. Blockchain security firm Hypernative estimated the suspicious outflows at more than $40 million, including roughly 106 BTC, 2,852 ETH, 10,700 SOL and 6.7 million XLM; Arkham separately tagged an attacker wallet holding closer to $46.5 million across 61 addresses.

The transfers were ordinary signed transactions rather than a smart contract exploit, and how the attacker obtained signing authority over the exchange's wallets remains unknown. Mercado Bitcoin says no customer lost funds and no data was breached, and that it will absorb the loss from its own reserves. Tether CEO Paolo Ardoino said the company froze more than $4.5 million in USDT tied to the incident. The exchange has also published the destination addresses the attacker used, on five networks, so other security researchers can help trace the funds.

A PATTERN THAT CUTS BOTH WAYS

Put the two incidents next to each other and neither side of the self-custody argument gets to feel smug. BTCPay Server proves that running your own Bitcoin infrastructure only protects you if you actually install the updates; the software was non-custodial, open-source and exactly the kind of setup Bitcoiners recommend, and merchants still lost money because they were two patch versions behind. Mercado Bitcoin proves the opposite failure: a centralized exchange can say nobody was harmed and no data leaked, and still be publishing the addresses its attacker used to move $40 million out the door.

An exchange that says nobody got hurt and then hands out the hacker's wallet addresses is telling you two different things at once. Read the second one.

This story comes from the Simply Bitcoin Live show. Watch the full episode.